Login Request a demo
Critical severity · published Jul 7, 2022
CVE-2022-34592
Wavlink WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability via the function obtw
9.8
CVSS
3.3%
EPSS
No
On KEV
Description
Wavlink WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability via the function obtw. This vulnerability allows attackers to execute arbitrary commands via a crafted POST request.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WF
Wl-wn575a3 Firmware · Wavlink
rpt75a3.v4300.201217 · source: NVD
Affected product
WF
Wl-wn575a3 Firmware
Wavlink
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-34592
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-34592
Exploit
https://github.com/winmt/CVE/blob/main/WAVLINK%20WL-WN575A3/README.md
github.com
https://github.com/winmt/my-vuls/tree/main/WAVLINK%20WL-WN575A3
More from Wl-wn575a3 Firmware
9.8
CVE-2023-38861
An issue in Wavlink WL_WNJ575A3 v.R75A3_V1410_220513 allows a remote attacker to execute arbitrary code via username parameter of the set_sys_adm function in adm.cgi
9.8
CVE-2022-37149
WAVLINK WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability when operating the file adm.cgi
8.8
CVE-2020-10971
An issue was discovered on Wavlink Jetstream devices where a crafted POST request can be sent to adm.cgi that will result in the execution of the supplied command if there is an…
7.5
CVE-2020-10974
An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password
7.5
CVE-2020-12266
An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store system information for internal usage